@fitlab-ai/agent-infra 0.11.9 → 0.11.10

package/dist/bin/internal-cli.js

@@ -13,7 +13,6 @@ const taskWorkflowCommand = command === 'task-artifact'
     || command === 'task-review'
     || command === 'task-event'
     || command === 'task-ledger'
-    || command === 'task-invalidation'
     || command === 'task-warning';
 const taskPlatformRecoveryCommand = command === 'task-platform-recovery';
 const manualValidationWorkflowCommand = command === 'manual-validation';
@@ -231,11 +230,6 @@ if (!controlRouted && !taskViewGuardFailed && internalRouteRegistered)
             await taskEvent(process.argv.slice(3));
             break;
         }
-        case 'task-invalidation': {
-            const { taskInvalidation } = await import('../lib/internal/task-invalidation.js');
-            taskInvalidation(process.argv.slice(3));
-            break;
-        }
         case 'task-lifecycle': {
             const { taskLifecycle } = await import('../lib/internal/task-lifecycle.js');
             await taskLifecycle(process.argv.slice(3));

package/dist/lib/git/workflow.js

@@ -103,7 +103,7 @@ function commitExplicitPaths(input, runner = defaultRunner) {
         if (tree !== input.expectedTree)
             return { status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'applied' }], error: { code: 'GIT_TREE_MISMATCH', message: `Expected staged tree ${input.expectedTree}, received ${tree ?? 'unavailable'}` } };
     }
-    const commit = run(runner, input.cwd, ['commit', '-m', input.message]);
+    const commit = run(runner, input.cwd, ['commit', '--cleanup=verbatim', '-m', input.message]);
     const after = inspectGitWorkflow(input.cwd, runner);
     if (commit.status !== 0)
         return { status: 'failed', changed: false, snapshot: after.snapshot, operations: [{ name: 'commit', status: 'failed', message: commit.stderr.trim() }], error: { code: 'GIT_COMMIT_FAILED', message: commit.stderr.trim() } };

package/dist/lib/internal/cli-route-inventory.js

@@ -57,7 +57,6 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'task-orchestration': ['status', 'progress'],
     'task-review': ['preflight', 'finalize-summary'],
     'task-event': ['event'],
-    'task-invalidation': ['reconcile'],
     'task-lifecycle': ['intent'],
     'task-finalization': ['complete'],
     'task-platform-recovery': ['inspect', 'recover'],
@@ -105,8 +104,6 @@ export function internalRouteSelector(command, args) {
         return args[1] === 'status' ? 'status' : args[1] ? 'progress' : '';
     if (command === 'task-review')
         return args[1] ?? '';
-    if (command === 'task-invalidation')
-        return args[1] ?? '';
     if (command === 'task-artifact')
         return args[1] ?? '';
     if (command === 'platform-pr-review' && first(args) === 'publish') {

package/dist/lib/internal/sandbox-control.js

@@ -4,8 +4,9 @@ import { serveSandboxControl } from '../sandbox/control/server.js';
 import { runSandboxControlExecutor } from '../sandbox/control/executor.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 import { parseTaskCreateResult, taskCreateExitCode } from '../task/create-service.js';
-function writeFinalizationEnvelope(status, accepted, error, changed = false, result = null) {
-    process.stdout.write(`${JSON.stringify({ version: 1, status, changed, accepted, result, error })}\n`);
+import { serializeTaskFinalizationEnvelope } from '../task/finalization-envelope.js';
+function writeFinalizationEnvelope(status, accepted, error, changed = false, result = null, requestId = null) {
+    process.stdout.write(serializeTaskFinalizationEnvelope({ status, changed, accepted, requestId, result, error }));
 }
 function finalizationErrorStatus(error) {
     if (error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN')
@@ -30,6 +31,28 @@ function recoveredExitCode(response) {
     }
     return response.exitCode ?? 1;
 }
+function finalizationResponseOutput(response) {
+    try {
+        const value = JSON.parse(response.stdout);
+        if (value.version === 2
+            && value.status
+            && ['completed', 'failed', 'blocked', 'unknown'].includes(value.status)
+            && (typeof value.changed === 'boolean' || value.changed === null)) {
+            return serializeTaskFinalizationEnvelope({
+                status: value.status,
+                changed: value.changed,
+                accepted: true,
+                requestId: response.id,
+                result: value.result ?? null,
+                error: value.error ?? null
+            });
+        }
+    }
+    catch {
+        // Preserve non-envelope output for diagnostics from the executor.
+    }
+    return response.stdout;
+}
 function sandboxFinalizationClient(args) {
     if (args.length !== 4 || !args[0] || args[1] !== 'complete' || args[2] !== '--agent' || !args[3]) {
         const error = { code: 'TASK_FINALIZATION_PAYLOAD_INVALID', message: 'task ref, complete intent, and --agent are required', retryable: false };
@@ -52,7 +75,8 @@ function sandboxFinalizationClient(args) {
     catch (error) {
         if (!(error instanceof SandboxControlClientError))
             throw error;
-        writeFinalizationEnvelope(finalizationErrorStatus(error.detail), error.accepted, error.detail);
+        const status = finalizationErrorStatus(error.detail);
+        writeFinalizationEnvelope(status, error.accepted, error.detail, status === 'unknown' ? null : false, null, error.requestId);
         writeClientError(error);
         process.exitCode = error.detail.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 1 : error.detail.retryable ? 2 : 1;
         return;
@@ -63,12 +87,13 @@ function sandboxFinalizationClient(args) {
             message: 'sandbox control rejected the finalization request',
             retryable: false
         };
-        writeFinalizationEnvelope(finalizationErrorStatus(error), error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN', error);
+        const status = finalizationErrorStatus(error);
+        writeFinalizationEnvelope(status, error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN', error, status === 'unknown' ? null : false, null, response.id);
         process.stderr.write(`${error.message}\n`);
         process.exitCode = error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 1 : error.retryable ? 2 : 1;
         return;
     }
-    process.stdout.write(response.stdout);
+    process.stdout.write(finalizationResponseOutput(response));
     process.stderr.write(response.stderr);
     process.exitCode = response.exitCode ?? 1;
 }

package/dist/lib/internal/task-finalization.js

@@ -1,14 +1,13 @@
 import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../task/control-authority.js';
-import { applyTaskFinalization, bindTaskFinalizationReceipt, prepareTaskFinalization } from '../task/finalization.js';
-import { publishTaskFinalizationHandoff } from '../task/finalization-handoff.js';
+import { applyTaskFinalization } from '../task/finalization.js';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
-import { verifyTaskEvent } from '../task/verification.js';
 import { resolveSandboxControlTransport } from './task-operation-registry.js';
 import { requestSandboxTaskFinalization, SandboxControlClientError } from '../sandbox/control/client.js';
+import { serializeTaskFinalizationEnvelope } from '../task/finalization-envelope.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n';
-function envelope(status, changed, accepted, result, error) {
-    return `${JSON.stringify({ version: 1, status, changed, accepted, result, error })}\n`;
+function envelope(status, changed, accepted, result, error, requestId = null) {
+    return serializeTaskFinalizationEnvelope({ status, changed, accepted, requestId, result, error });
 }
 function exitCode(status) {
     return status === 'completed' ? 0 : status === 'blocked' ? 2 : 1;
@@ -65,22 +64,9 @@ async function taskFinalization(args = []) {
     };
     const transport = resolveSandboxControlTransport(process.env, { localWorkflow: true });
     if (transport.kind === 'sandbox-local') {
-        const prepared = await prepareTaskFinalization(boundOperation.request, {
-            repoRoot,
-            preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
-        });
-        if (prepared.status !== 'prepared') {
-            process.stdout.write(envelope(prepared.status, prepared.changed, true, prepared, prepared.error));
-            process.exitCode = exitCode(prepared.status);
-            return;
-        }
         try {
             const response = requestSandboxTaskFinalization({
-                agent: boundOperation.request.agent,
-                prepareHandoff: (binding) => {
-                    const receipt = bindTaskFinalizationReceipt(repoRoot, boundOperation.request.taskRef, binding);
-                    return publishTaskFinalizationHandoff('/share/branch', receipt, binding);
-                }
+                agent: boundOperation.request.agent
             });
             process.stdout.write(response.stdout);
             process.stderr.write(response.stderr);
@@ -88,11 +74,16 @@ async function taskFinalization(args = []) {
             return;
         }
         catch (error) {
-            const detail = error instanceof SandboxControlClientError
-                ? error.detail
+            const clientError = error instanceof SandboxControlClientError ? error : null;
+            const detail = clientError
+                ? clientError.detail
                 : { code: 'SANDBOX_CONTROL_CLIENT_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false };
-            process.stdout.write(envelope(detail.retryable ? 'blocked' : 'failed', false, false, null, detail));
-            process.exitCode = detail.retryable ? 2 : 1;
+            const status = detail.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN'
+                ? 'unknown'
+                : detail.retryable ? 'blocked' : 'failed';
+            const changed = status === 'unknown' ? null : false;
+            process.stdout.write(envelope(status, changed, clientError?.accepted ?? false, null, detail, clientError?.requestId ?? null));
+            process.exitCode = exitCode(status);
             return;
         }
     }

package/dist/lib/internal/task-operation-registry.js

@@ -102,9 +102,8 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-review', 'preflight', 'task-bound', 'artifact-write'),
         descriptor('internal', 'task-review', 'finalize-summary', 'task-bound', 'progress'),
         descriptor('internal', 'task-event', 'event', 'task-bound', 'progress'),
-        descriptor('internal', 'task-invalidation', 'reconcile', 'task-bound', 'progress'),
         descriptor('internal', 'task-lifecycle', 'intent', 'task-bound', 'progress'),
-        descriptor('internal', 'task-finalization', 'complete', 'task-bound', 'progress'),
+        descriptor('internal', 'task-finalization', 'complete', 'task-bound', 'recovery'),
         descriptor('internal', 'task-platform-recovery', 'inspect', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-platform-recovery', 'recover', 'task-bound', 'recovery'),
         descriptor('internal', 'task-short-id', 'list', 'conditional', 'diagnostic'),
@@ -179,7 +178,7 @@ export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
     'git-workflow', 'task-delivery', 'release-workflow', 'platform-release-notes', 'platform-security', 'platform-metadata', 'platform-context',
     'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
     'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
-    'task-orchestration', 'task-review', 'task-event', 'task-invalidation', 'task-lifecycle',
+    'task-orchestration', 'task-review', 'task-event', 'task-lifecycle',
     'task-finalization', 'task-platform-recovery', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);
 export const PUBLIC_DISPATCHER_ROUTES = Object.freeze([

package/dist/lib/internal/task-platform-recovery.js

@@ -2,7 +2,7 @@ import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
 import { readPlatformOperationJournal } from '../task/platform-operation-journal.js';
 import { recoverPlatformOperations } from '../task/platform-operation-recovery.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal task-platform-recovery <N | TASK-id> <inspect | recover> [--agent <agent>] [--selection required|deferred|all]\n';
+const USAGE = 'Usage: agent-infra-internal task-platform-recovery <N | TASK-id> <inspect | recover> [--agent <agent>] [--selection required|deferred|all] [--attempts <positive-integer>]\n';
 function option(args, name) {
     const index = args.indexOf(name);
     return index >= 0 ? args[index + 1] : undefined;
@@ -41,14 +41,19 @@ async function taskPlatformRecovery(args = []) {
     }
     const agent = option(args, '--agent');
     const selection = option(args, '--selection') ?? 'all';
+    const attemptsInput = option(args, '--attempts');
+    const attempts = attemptsInput === undefined ? undefined : Number(attemptsInput);
+    const validAttempts = attemptsInput === undefined
+        || (attempts !== undefined && Number.isSafeInteger(attempts) && attempts > 0);
     if (!agent || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(agent)
-        || !['required', 'deferred', 'all'].includes(selection)) {
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'PLATFORM_OPERATION_RECOVERY_PAYLOAD_INVALID', message: 'recover requires a valid --agent and --selection' } })}\n`);
+        || !['required', 'deferred', 'all'].includes(selection)
+        || !validAttempts) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'PLATFORM_OPERATION_RECOVERY_PAYLOAD_INVALID', message: 'recover requires a valid --agent, --selection, and positive --attempts when supplied' } })}\n`);
         process.stderr.write(USAGE);
         process.exitCode = 1;
         return;
     }
-    const result = await recoverPlatformOperations(task.taskId, selection, { agent, cwd: repoRoot });
+    const result = await recoverPlatformOperations(task.taskId, selection, { agent, cwd: repoRoot, ...(attempts === undefined ? {} : { attempts }) });
     process.stdout.write(`${JSON.stringify(result)}\n`);
     process.exitCode = result.status === 'applied' || result.status === 'no-op' ? 0 : result.status === 'blocked' ? 2 : 1;
 }

package/dist/lib/platform/completion-backfill.js

@@ -8,6 +8,7 @@ import { getOpenWorkflowWarnings } from '../task/workflow-warnings.js';
 import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js';
 import { captureTaskWriteMetadata } from '../task/write.js';
 import { syncPlatformComment } from './issue-comments.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { platformResult } from './types.js';
 import { taskIssueIdentity } from './task-identities.js';
 function result(base, artifacts, warnings) {
@@ -124,7 +125,7 @@ async function backfillCompletionComments(taskRef, options) {
         if (latest.status === 'failed' || latest.status === 'blocked')
             return result({ ...latest, operations }, artifacts, []);
         if (latest.error)
-            return result(platformResult(latest.error.retryable ? 'blocked' : 'failed', {
+            return result(platformResult(latest.error.retryable || providerErrorRetryable(latest.error.code) ? 'blocked' : 'failed', {
                 platform: latest.platform,
                 resource: latest.resource,
                 capabilities: latest.capabilities,

package/dist/lib/platform/context.js

@@ -1,18 +1,20 @@
 import path from 'node:path';
 import { loadPlatformProvider } from './provider-loader.js';
 import { defaultGitRemote, parseGitHubRemote } from './github-provider.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { platformResult } from './types.js';
 function errorStatus(error) {
-    if (error.retryable || error.code === 'AUTH_REQUIRED' || error.code === 'PLATFORM_DEPENDENCY_MISSING')
+    if (error.retryable || providerErrorRetryable(error.code) || error.code === 'AUTH_REQUIRED' || error.code === 'PLATFORM_DEPENDENCY_MISSING')
         return 'blocked';
     if (error.code === 'REMOTE_MISSING' || error.code === 'PLATFORM_UNSUPPORTED')
         return 'no-op';
     return 'failed';
 }
 function contextError(providerType, error, repository = null) {
+    const retryable = error.retryable ?? providerErrorRetryable(error.code);
     return platformResult(errorStatus(error), {
         platform: { type: providerType || null, repository, currentUser: null },
-        error: { code: error.code, message: error.message, retryable: error.retryable }
+        error: { code: error.code, message: error.message, retryable }
     });
 }
 function contextFromSnapshot(providerType, snapshot) {

package/dist/lib/platform/github-client.js

@@ -59,30 +59,33 @@ function classifyGitHubFailure(result) {
         return {
             code: 'PLATFORM_OUTPUT_TOO_LARGE',
             message: 'GitHub CLI output exceeded the configured limit',
-            retryable: false
+            requestRetryable: false
         };
     }
     const detail = boundedFailureDetail(result);
     const lower = detail.toLowerCase();
     if (/\b401\b|bad credentials|authentication required|not logged into/.test(lower)) {
-        return { code: 'AUTH_REQUIRED', message: detail || 'GitHub authentication is required', retryable: false };
+        return { code: 'AUTH_REQUIRED', message: detail || 'GitHub authentication is required', requestRetryable: false };
     }
     if (/\b429\b|rate limit|secondary rate|\b5\d\d\b|timeout|timed out|econnreset|enotfound|dns|tls|socket|network/.test(lower)) {
-        return { code: 'NETWORK_TRANSIENT', message: detail || 'GitHub request failed temporarily', retryable: true };
+        return { code: 'NETWORK_TRANSIENT', message: detail || 'GitHub request failed temporarily', requestRetryable: true };
     }
     if (/\b403\b|resource not accessible|permission denied/.test(lower)) {
-        return { code: 'PERMISSION_DENIED', message: detail || 'GitHub permission denied', retryable: false };
+        return { code: 'PERMISSION_DENIED', message: detail || 'GitHub permission denied', requestRetryable: false };
     }
     if (/\b404\b/.test(lower)) {
-        return { code: 'RESOURCE_NOT_FOUND', message: detail || 'GitHub resource not found', retryable: false };
+        return { code: 'RESOURCE_NOT_FOUND', message: detail || 'GitHub resource not found', requestRetryable: false };
     }
     if (/\b422\b|validation failed/.test(lower)) {
-        return { code: 'PLATFORM_REQUEST_INVALID', message: detail || 'GitHub rejected the request', retryable: false };
+        return { code: 'PLATFORM_REQUEST_INVALID', message: detail || 'GitHub rejected the request', requestRetryable: false };
     }
     if (errorCode === 'ENOENT') {
-        return { code: 'PLATFORM_DEPENDENCY_MISSING', message: detail || 'GitHub CLI is unavailable', retryable: false };
+        return { code: 'PLATFORM_DEPENDENCY_MISSING', message: detail || 'GitHub CLI is unavailable', requestRetryable: false };
     }
-    return { code: 'PLATFORM_REQUEST_FAILED', message: detail || 'GitHub request failed', retryable: false };
+    return { code: 'PLATFORM_REQUEST_FAILED', message: detail || 'GitHub request failed', requestRetryable: false };
+}
+function clientError(error) {
+    return { code: error.code, message: error.message };
 }
 function responseUrl(args) {
     const endpoint = args.find((arg, index) => index > 0 && !arg.startsWith('-')) || '';
@@ -132,14 +135,14 @@ function createGitHubClient(options = {}) {
             if (result.status === 0)
                 return { ok: true, value: result.stdout };
             const error = classifyGitHubFailure(result);
-            if (!retryableMethod || !error.retryable)
-                return { ok: false, error };
+            if (!retryableMethod || !error.requestRetryable)
+                return { ok: false, error: clientError(error) };
             if (attempt >= delays.length) {
                 return {
                     ok: false,
                     error: error.code === 'NETWORK_TRANSIENT'
-                        ? { ...error, code: 'NETWORK_RETRY_EXHAUSTED', message: `${error.message} (retry exhausted)` }
-                        : error
+                        ? { ...clientError(error), code: 'NETWORK_RETRY_EXHAUSTED', message: `${error.message} (retry exhausted)` }
+                        : clientError(error)
                 };
             }
             sleep(delays[attempt]);
@@ -150,12 +153,12 @@ function createGitHubClient(options = {}) {
         version(request = {}) {
             const result = runner(['--version'], request);
             if (result.status !== 0)
-                return { ok: false, error: classifyGitHubFailure(result) };
+                return { ok: false, error: clientError(classifyGitHubFailure(result)) };
             const version = result.stdout.match(/^gh version (\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)(?:\s|$)/m)?.[1];
             if (!version || !semver.valid(version)) {
                 return {
                     ok: false,
-                    error: { code: 'GH_CLI_VERSION_INVALID', message: 'GitHub CLI returned an invalid version', retryable: false }
+                    error: { code: 'GH_CLI_VERSION_INVALID', message: 'GitHub CLI returned an invalid version' }
                 };
             }
             return { ok: true, value: version };
@@ -174,7 +177,7 @@ function createGitHubClient(options = {}) {
             catch {
                 return {
                     ok: false,
-                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub returned invalid JSON', retryable: true }
+                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub returned invalid JSON' }
                 };
             }
         },
@@ -189,12 +192,12 @@ function createGitHubClient(options = {}) {
             if (!parsed) {
                 return {
                     ok: false,
-                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub response metadata or JSON is invalid', retryable: true }
+                    error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub response metadata or JSON is invalid' }
                 };
             }
             return { ok: true, value: parsed };
         }
     };
 }
-export { classifyGitHubFailure, createGitHubClient, MINIMUM_GITHUB_CLI_VERSION, parseIncludedResponse };
+export { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION, parseIncludedResponse };
 //# sourceMappingURL=github-client.js.map

package/dist/lib/platform/github-provider.js

@@ -7,6 +7,32 @@ import semver from 'semver';
 import { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION } from './github-client.js';
 import { resourceIdentityNumber, resourceIdentityString } from './resource-identity.js';
 import { extractPullRequestFileNames, syncLabelDelta } from './in-label-sync.js';
+function providerError(error) {
+    return { code: error.code, message: error.message };
+}
+function publicProviderErrors(provider) {
+    const sanitize = async (call) => {
+        const result = await call();
+        if (!result || typeof result !== 'object' || result.ok !== false)
+            return result;
+        const envelope = result;
+        return envelope.error ? { ...result, error: providerError(envelope.error) } : result;
+    };
+    const wrapped = { ...provider, context: { ...provider.context } };
+    wrapped.context.resolve = (input) => sanitize(() => provider.context.resolve(input));
+    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'securityAlerts', 'repositoryMetadata', 'verification']) {
+        const group = provider[groupName];
+        if (!group)
+            continue;
+        const target = { ...group };
+        for (const method of Object.keys(group)) {
+            const original = group[method];
+            target[method] = (input) => sanitize(() => original(input));
+        }
+        wrapped[groupName] = target;
+    }
+    return wrapped;
+}
 const CURRENT_USER_QUERY = 'query { viewer { login } }';
 const ISSUE_TYPES_QUERY = `query($owner:String!){organization(login:$owner){issueTypes(first:20){nodes{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}}}}}`;
 const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
@@ -57,7 +83,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: 'Pull request repository identity is inconsistent',
-                retryable: false
             }
         };
     }
@@ -80,7 +105,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: 'Pull request Git refs are invalid',
-                retryable: false
             }
         };
     }
@@ -97,7 +121,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: `No GitHub remote can provide evidence for ${repository}`,
-                retryable: false
             }
         };
     }
@@ -107,7 +130,7 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
     };
 }
 function failure(error) {
-    return { ok: false, error };
+    return { ok: false, error: providerError(error) };
 }
 function resolveContext(client, input) {
     const cwd = input.workingDirectory;
@@ -118,19 +141,17 @@ function resolveContext(client, input) {
         return failure({
             code: 'GH_CLI_VERSION_UNSUPPORTED',
             message: 'GitHub CLI ' + version.value + ' is unsupported; install gh >= ' + MINIMUM_GITHUB_CLI_VERSION,
-            retryable: false
         });
     }
     const remote = input.gitRemote || defaultGitRemote(cwd);
     if (!remote) {
-        return failure({ code: 'REMOTE_MISSING', message: 'Git origin remote is not configured', retryable: false });
+        return failure({ code: 'REMOTE_MISSING', message: 'Git origin remote is not configured' });
     }
     const ownerRepo = parseGitHubRemote(remote);
     if (!ownerRepo) {
         return failure({
             code: /github\.com/i.test(remote) ? 'REMOTE_INVALID' : 'PLATFORM_UNSUPPORTED',
             message: 'Unable to parse GitHub owner/repo from configured remote',
-            retryable: false
         });
     }
     const repository = client.json(['api', 'repos/' + ownerRepo], { cwd });
@@ -142,7 +163,6 @@ function resolveContext(client, input) {
         return failure({
             code: 'UPSTREAM_UNRESOLVED',
             message: 'Unable to resolve the upstream repository',
-            retryable: false
         });
     const user = client.json(['api', 'graphql', '-f', 'query=' + CURRENT_USER_QUERY], { cwd });
     if (!user.ok)
@@ -193,7 +213,7 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
     if (!wanted.ref || !/^[A-Za-z0-9._/-]+$/.test(wanted.ref))
         return {
             ok: false,
-            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid', retryable: false }
+            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid' }
         };
     const remotes = configuredGitRemotes(cwd);
     const remote = remotes.find((item) => item.repository.toLowerCase() === wanted.repository.toLowerCase())
@@ -201,7 +221,7 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
     if (!remote)
         return {
             ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}`, retryable: false }
+            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}` }
         };
     try {
         const output = execFileSync('git', ['ls-remote', '--refs', remote.name, `refs/heads/${wanted.ref}`], {
@@ -212,19 +232,19 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
         if (!sha || !/^[a-f0-9]{40}$/i.test(sha))
             return {
                 ok: false,
-                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist`, retryable: false }
+                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist` }
             };
         return { ok: true, value: sha };
     }
     catch (error) {
         return {
             ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: true }
+            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) }
         };
     }
 }
 function invalid(code, message) {
-    return { ok: false, error: { code, message, retryable: false } };
+    return { ok: false, error: { code, message } };
 }
 function changeRequestSnapshot(value) {
     return {
@@ -292,7 +312,7 @@ function createReceipt(remoteId) {
     return { ok: true, value: { changed: true, remoteId } };
 }
 function partialFailure(response, value) {
-    return { ok: false, error: response.error, value };
+    return { ok: false, error: providerError(response.error), value };
 }
 function labelReconciliation(created, updated, removed, skipped) {
     return {
@@ -319,8 +339,8 @@ function syncLabels(client, repositoryName, number, cwd, current, target, prefix
                     status: 'blocked',
                     changed: true,
                     error: synced.error
-                        ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
-                        : { code: 'IN_LABEL_SYNC_PARTIAL', message: 'In-label synchronization is partial or unknown', retryable: true }
+                        ? { ...providerError(synced.error), code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
+                        : { code: 'IN_LABEL_SYNC_PARTIAL', message: 'In-label synchronization is partial or unknown' }
                 };
             return synced;
         }
@@ -599,7 +619,7 @@ function createGitHubOperations(client) {
                 localHead = repositoryHead(context.workingDirectory);
             }
             catch (error) {
-                return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false } };
+                return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };
             }
             const remote = verifyRemoteBranch(context.workingDirectory, repository(context), head);
             if (!remote.ok)
@@ -607,7 +627,7 @@ function createGitHubOperations(client) {
             if (remote.value !== localHead)
                 return {
                     ok: false,
-                    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}`, retryable: false }
+                    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}` }
                 };
             return { ok: true, value: { sha: localHead } };
         },
@@ -904,7 +924,7 @@ function createGitHubOperations(client) {
                 const tag = resourceIdentityString(release) || '';
                 const result = module.publishGitHubReleaseNotes({ repository: repository(context), tag, title, notesFile }, { cwd: context.workingDirectory, client });
                 if (result.status === 'failed' || result.status === 'blocked')
-                    return { ok: false, error: result.error || { code: 'RELEASE_NOTES_PUBLISH_FAILED', message: 'Release notes publish failed', retryable: false } };
+                    return { ok: false, error: result.error ? providerError(result.error) : { code: 'RELEASE_NOTES_PUBLISH_FAILED', message: 'Release notes publish failed' } };
                 return { ok: true, value: { changed: result.changed, remoteId: tag } };
             }
             finally {
@@ -917,7 +937,7 @@ function createGitHubOperations(client) {
                 repository: repository(context), commitOids, branch, historyLimit, fromTime, toTime
             }, { cwd: context.workingDirectory, client });
             if (collected.status === 'failed' || collected.status === 'blocked' || !('pullRequests' in collected)) {
-                return { ok: false, error: collected.error || { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected', retryable: false } };
+                return { ok: false, error: collected.error ? providerError(collected.error) : { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected' } };
             }
             const mergedPullRequests = collected.pullRequests.map((item) => ({
                 id: String(item.number), identity: { kind: 'number', value: Number(item.number) }, number: Number(item.number),
@@ -1114,7 +1134,7 @@ function createGitHubOperations(client) {
     return { issues, comments, changeRequests, checks, reviews, releases, securityAlerts, repositoryMetadata, verification };
 }
 function createGitHubProvider(input, client = createGitHubClient()) {
-    return {
+    return publicProviderErrors({
         type: input.providerType,
         contractVersion: 2,
         identity: { issue: 'number', 'pull-request': 'number', comment: 'number', release: 'key' },
@@ -1124,7 +1144,7 @@ function createGitHubProvider(input, client = createGitHubClient()) {
                 return resolveContext(client, contextInput);
             }
         }
-    };
+    });
 }
 export { configuredGitRemotes, createGitHubProvider, defaultGitRemote, parseGitHubRemote, resolveGitHubChangeRequestGitEvidence };
 //# sourceMappingURL=github-provider.js.map

package/dist/lib/platform/github-release-notes.js

@@ -1,4 +1,5 @@
 import { createGitHubClient } from './github-client.js';
+import { providerErrorRetryable } from './provider-validation.js';
 function normalizeGitHubActor(actor) {
     const name = String(actor.name || '').trim();
     const email = actor.email ? String(actor.email).trim() : null;
@@ -26,12 +27,13 @@ function normalizePlatformAuthor(author) {
     };
 }
 function failure(error) {
+    const retryable = error.retryable ?? providerErrorRetryable(error.code);
     return {
-        status: error.retryable ? 'blocked' : 'failed',
+        status: retryable ? 'blocked' : 'failed',
         changed: false,
         operation: null,
         url: null,
-        error
+        error: { code: error.code, message: error.message }
     };
 }
 function publishGitHubReleaseNotes(input, options = {}) {

package/dist/lib/platform/in-label-sync.js

@@ -1,5 +1,6 @@
 import { computeInLabels } from './metadata-labels.js';
 import { createHash } from 'node:crypto';
+import { providerErrorRetryable } from './provider-validation.js';
 function inLabels(labels) {
     return [...new Set(labels.filter((label) => label.startsWith('in:')))].sort();
 }
@@ -96,7 +97,7 @@ function syncLabelDelta(client, repository, number, cwd, current, target, prefix
     const delta = labelDelta(current, target, prefix);
     let changed = false;
     const failure = (error) => {
-        if (changed || error.retryable) {
+        if (changed || error.retryable || providerErrorRetryable(error.code)) {
             return {
                 status: 'blocked',
                 changed,